The Internet is a massive network of networks in which computers communicate with each other via use of different communication protocols. The Internet includes packet-routing devices, such as switches, routers and the like, interconnecting many computer devices. To support routing of information such as packets, each of the packet-routing devices typically maintains routing tables to perform routing decisions in which to forward traffic from a source computer, through the network, to a destination computer.
Virtual Private Networks (VPNs) are becoming an increasingly popular mechanism to interconnect multiple remote sites of a common entity, such as a corporation, university, governmental institution, or other enterprise. A VPN allows remote sites to interconnect as if co-located by providing message transport, security, and node addressing. Such a VPN interconnects multiple sub networks, or local area networks (LANs), of an enterprise such as a corporation, university, or distributor, for example. The sub networks, in turn, interconnect with each other via a public access network such as the Internet. Such a sub network interconnection is typically known as a core network, and includes service providers having a high-speed backbone of routers and trunk lines. Each of the sub networks and the core networks has entry points known as edge routers, through which traffic entering and exiting from the network flows. The core network has ingress/egress points handled by nodes known as provider edge (PE) routers, while the sub networks have ingress/egress points known as customer edge (CE) routers, discussed further in Internet Engineering Task Force (IETF) RFC 2547bis, concerning Virtual Private Networks (VPNs).
An interconnection between the sub networks of a VPN, therefore, typically includes one or more core networks. Each of the core networks is usually one or many autonomous systems (AS), meaning that it employs and enforces a common routing policy among the nodes (routers) included therein. Accordingly, the nodes of the core networks often employ a protocol operable to provide high-volume transport with path based routing, meaning that the protocol not only specifies a destination (as in TCP/IP), thus, the protocol does not merely specify a destination, as in TCP/IP; it implements an addressing strategy that allows for unique identification of end points, and also allows specification of a particular routing path through the core network. One such protocol is the Multi-protocol Label Switching (MPLS) protocol, defined in Internet Engineering Task Force (IETF) RFC 3031. MPLS is a protocol that combines the label-based forwarding of ATM networks, with the packet-based forwarding of IP networks and then builds applications upon this infrastructure.
Traditional MPLS, and more recently Generalized MPLS(G-MPLS) networks as well, extend the suite of IP protocols to expedite the forwarding scheme used by conventional IP routers, particularly through core networks employed by service providers (as opposed to end-user connections or taps). Routers, to date, have used complex and time-consuming route lookups and address matching schemes to determine the next hop for a received packet, primarily by examining the destination address in the header of the packet. MPLS has greatly simplified this operation by basing the forwarding decision on a simple label stack. Another major feature of MPLS is its ability to place IP traffic on an explicitly defined path through the network. Such path specification capability is generally not available with conventional IP traffic. In this way, MPLS provides bandwidth guarantees and other differentiated service features for a specific user application (or flow). Current IP-based MPLS networks are emerging for providing advanced services such as bandwidth-based guaranteed service, priority-based bandwidth allocation, and preemption services.
For each specific service, a table for a forwarding equivalence class (FEC) is created to represent a group of flows with the same traffic-engineering requirements. A specific label is then bound to a FEC. At the ingress of an MPLS network, incoming IP packets are examined and assigned a “label” by a label edge router (LER). The labeled packets are then forwarded along an LSP, where each label-switching router (LSR) makes a switching decision based on the contents of a packet's MPLS shim header. Such LSRs avoid examining the IP headers of the packets to find an output port (next hop). In one example configuration, a LSR simply strips off the existing label and applies a new label for the next hop. The label information base (LIB) provides an outgoing label (to be inserted into the packet) and an outgoing interface (based on an incoming label on an incoming interface).
Therefore, MPLS uses a technique called label switching (or swapping or popping) as a means to transport data across a network. The routers within an MPLS network that are responsible for label processing are known as Label Switching Routers (LSRs), and the path followed by data is known as a Label Switched Path (LSP). Upon entry to an MPLS network, such as from a CE router via a PE router, an MPLS-specific header is inserted at the front of each packet to in effect, re-encapsulate it. The MPLS header contains a stack of labels—one or more—that uniquely identify the switching path between any two LSRs. This label tells adjacent switching nodes how to process and forward the data. As a node receives each packet, it may push a new label onto the stack of a packet before forwarding it on, pop one from the stack, or swap one or more of the labels with new ones. The path of the packet through the network is defined by its initial labeling. Accordingly, the subsequent mapping of labels is consistent at each node so as to form a complete label switched path between the ingress to and the egress from the MPLS network.
Netflow allows for granular and accurate traffic flow measurements by recording network traffic into the device cache. Since network traffic has a flow based nature to it, the NetFlow accounting data that is built in the cache, characterizes the IP traffic being forwarded. NetFlow data records exported by routers and switches consist of active traffic flows with detailed traffic statistics. These flows contain information about source and destination IP addresses along with the protocols and ports used in the end-to-end conversation. This exported NetFlow data is collected and analyzed by NetFlow Analyzer to generate reports on top hosts, top applications, and top conversations using bandwidth in your network. NetFlow combined with NetFlow Analyzer yields valuable information about the behavior of traffic on your network. Armed with this information, it is easier to make critical decisions on bandwidth capacity, security, and optimal usage of network infrastructure.